PWS_VDP Enterprise Management System_v2_27 Jun 25.pdf

CUI FAXXXXXXXXXXX

CUI

PERFORMANCE WORK STATEMENT

FOR

VULNERABILITY DISCLOSURE PROGRAM ENTERPRISE MANAGEMENT

SYSTEM

AT

LINTHICUM HEIGHTS, MARYLAND

June 27, 2025

DRAFT

Controlled by: TBD CUI Categories: TBD Distribution/Dissemination Controls:

TBD

POC: TBD

SECTION I

1.0. GENERAL INFORMATION

1.1. General. The Department of Defense (DoD) Cyber Crime Center (DC3) Security office is responsible for managing a comprehensive Vulnerability Disclosure Program (VDP), and related services, to enhance the security of the DoD Information Network (DoDIN) and Defense Industrial Base (DIB) networks. This initiative, established in 2016 by the Secretary of Defense, leverages crowdsourced cybersecurity expertise to identify and remediate vulnerabilities, aligning with the DoD's defense-in-depth strategy, ISO 29147:2018 and ISO 30111 standards, and DoDI 8530.02, Cyber Incident Response.

1.2. Background. The DoD's computer networks and systems support the nation’s defense and are critical both for daily business operations and mission critical activities. Maintaining the security, confidentiality, availability, and integrity of DoD networks and systems is a matter of national security and requires the continuous identification and remediation of vulnerabilities that can be exploited by malicious cyber actors. As part of its responsibility to the public at large, DoD is constantly considering innovative and diverse approaches to meet this goal.

Crowdsourcing is a modern business practice that, as of 2010, the Federal Government has employed to obtain needed services, ideas, or content by soliciting contributions from a large group of people rather than from traditional employees or suppliers. Crowdsourcing incentivizes innovation in solving mission-centric problems. Remaining ahead of present and emerging cyber threats is a significant responsibility in any environment. For DoD, the responsibility is amplified as the repercussions associated with security failure are severe.

To support DoD's continual efforts to remain at the forefront of rapidly evolving technologies, and to maintain the highest levels of integrity and security required of its IT infrastructure, DoD has identified an emerging need to leverage a diverse pool of innovative information security researchers (herein referred to as "researchers") via crowdsourcing, for vulnerability discovery, coordination and disclosure activities.

SECTION II

2.0. SCOPE OF WORK

2.1. Objective. The Contractor will provide two enterprise management system licenses/subscriptions for DC3’s DoD VDP and DIB VDP which will facilitate collaboration, compliance, and management of a VDP.

2.2. The Contractor is responsible for providing a license/subscription to an enterprise management system for a VDP with the following components:

• Enterprise-grade VDP platform license/subscription (2 – DoD VDP and DIB VDP)

• Vulnerability Submission and Management Workflows

• Inbox, Security Page, Disclosure Workflow, Community Engagement

• Hacktivity, Leaderboard, Reputation System Integration Capabilities

• Seamless integration, via API, with existing DC3 IT systems such as DC3’s Vulnerability

Report Management Network (VRMN) on the NIPRNet and SIPRNet and the DIB VRMN server (NOTE: All VRMN systems are a ticketing and workflow management system based on Atlassian Jira)

• Ability to exchange the following types of data: vulnerability report data and associated artifacts, in JSON format, and artifacts are text, images, Python script, JavaScript, GO, video, dlls

• Mediation Support: The vendor platform must have a mediation service capability in the event a researcher needs to reach contact DC3-VDP through the platform to address a reporting issue. For example, if a researcher has a question regarding how DC3-VDP triaged a report, or why DC3-VDP triaged or closed a report in some way outside of their expectation.

• Tools and processes for effective vulnerability triage and resolution (1) such as CVSS, (2) a project page for the VDP that outlines DC3-VDP policy, rules of engagement and lanes in the road for researchers to read and accept, (3) the vendor’s platform must have a means of receiving a report, triaging a report and closing a report, (4) the vendor’s platform needs to have the capability of setting a severity to a report, and (5) needs to have a way of messaging the researcher that issued the report.

• Advanced analytics, KPIs, and custom reporting capabilities such for criteria such as, but not limited to, reports received, time to close, time to remediate, severity types, CVSS scores

• A dedicated account team with customer support and customer success functions with support times not to exceed 24-hours, a monthly meeting with a customer success manager to discuss account matters, direct updates for new features, new feature demos, etc.

• 250 crowdsourced vulnerability – bug tag and annual mailings. The vendor will be responsible for the cost and labor of the shipping and logistics for DC3-provided, -designed and -manufactured items, used to recognize researchers for their annual contributions to the

DC3 VDP.

2.3. The Period of Performance for this requirement is as follows:

• Base Year: 1 February 2026 – 31 January 2027

• Option Year One: 1 February 2027 – 31 January 2028

• Option Year Two: 1 February 2028 – 31 January 2029

• Option Year Three: 1 February 2029 – 31 January 2030

• Option Year Four: 1 February 2030 – 31 January 2031